Authentication (OAuth, LDAP, SCIM)

Single sign-on with Google, Microsoft, GitHub, Feishu and OpenID Connect, LDAP directories and SCIM provisioning.

These variables are set on the Hrida.ai container. Variables marked ConfigVar are saved to the database on first start — see how ConfigVar works before changing them later.

OAuth

info

You can only configure one OAUTH provider at a time. You cannot have two or more OAUTH providers configured simultaneously.

ENABLE_OAUTH_SIGNUP

• Type: bool
• Default: False
• Description: Enables account creation when signing up via OAuth. Distinct from ENABLE_SIGNUP.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_OAUTH_PERSISTENT_CONFIG

• Type: bool
• Default: False
• Description: When ENABLE_PERSISTENT_CONFIG is enabled, controls whether OAuth-related settings (config paths starting with oauth.) are also loaded from the database. When False, OAuth settings are always read from the environment variables instead.

info

By default (False), OAuth settings are read from your environment variables on every restart and are not loaded from the database, even if you previously changed them in the Admin Panel and even when ENABLE_PERSISTENT_CONFIG is True. This keeps environment variables authoritative for OAuth, which suits GitOps or immutable infrastructure where configuration lives in external files (e.g. Docker Compose, Kubernetes ConfigMaps).

Set this variable to True to persist OAuth settings in the database and manage them through the Admin Panel after initial setup, the same way other persistent settings behave.

OAUTH_SUB_CLAIM

• Type: str
• Default: None
• Description: Overrides the default claim used to identify a user's unique ID (sub) from the OAuth/OIDC provider's user info response. By default, Hrida.ai attempts to infer this from the provider's configuration. This variable allows you to explicitly specify which claim to use. For example, if your identity provider uses 'employee_id' as the unique identifier, you would set this variable to 'employee_id'.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_MERGE_ACCOUNTS_BY_EMAIL

• Type: bool
• Default: False
• Description: If enabled, merges OAuth accounts with existing accounts using the same email address. This is considered unsafe as not all OAuth providers will verify email addresses and can lead to potential account takeovers.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_OAUTH_EMAIL_FALLBACK

• Type: bool
• Default: False
• Description: Allows sign-in through OpenID Connect (OIDC) providers that do not return an email address. When enabled and the provider supplies no email claim, Hrida.ai creates the account with a placeholder address in the form <provider>@<sub>.local. When disabled, sign-in fails if the email is missing.
• Persistence: Read once at startup; not a ConfigVar.

warning

Email-based features such as password recovery, email notifications, and account merging via OAUTH_MERGE_ACCOUNTS_BY_EMAIL will not work for these accounts. Make sure your provider's sub claim is stable and unique. For standard providers (Google, Microsoft, GitHub) leave this False.

ENABLE_OAUTH_ID_TOKEN_COOKIE

• Type: bool
• Default: True
• Description: Controls whether the legacy oauth_id_token cookie (unsafe, not recommended, token can go stale/orphaned) is set in the browser upon a successful OAuth login. This is provided for backward compatibility with custom tools or older versions that might rely on scraping this cookie. The new, recommended approach is to use the server-side session management.
• Usage: For new and secure deployments, it is recommended to set this to False to minimize the information exposed to the client-side. Keep it as True only if you have integrations that depend on the old cookie-based method.

ENABLE_OAUTH_TOKEN_EXCHANGE

• Type: bool
• Default: False
• Description: Enables the OAuth token exchange endpoint, allowing external applications to exchange an OAuth provider's access token for an Hrida.ai JWT session token. This enables programmatic authentication for external tools and services that already have OAuth tokens from your identity provider.
• Usage: Set to true to enable the token exchange endpoint at /api/v1/auths/oauth/{provider}/token/exchange. When enabled, external applications can POST to this endpoint with an OAuth access token to obtain an Hrida.ai session token.

warning

Security Note: This feature should only be enabled when you have external applications that need to authenticate with Hrida.ai using OAuth tokens from your identity provider. Ensure proper access controls are in place for any external applications using this endpoint.

Request Example:

bash

curl -X POST "http://localhost:8080/api/v1/auths/oauth/google/token/exchange" \
  -H "Content-Type: application/json" \
  -d '{"token": "ya29.a0AfH6SMB..."}'

Response:

json

{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_at": 1735682400,
  "id": 1,
  "email": "user@example.com",
  "name": "John Doe",
  "role": "user",
  "profile_image_url": "https://...",
  "permissions": {...}
}

Requirements:

• The user must already exist in Hrida.ai (they must have signed in via the web interface at least once)
• The OAuth provider must be properly configured
• The token exchange uses the same user lookup logic as regular OAuth login (by OAuth sub claim first, then by email if OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled)

ENABLE_OAUTH_BACKCHANNEL_LOGOUT

• Type: bool
• Default: False
• Description: Enables OpenID Connect Back-Channel Logout support. When enabled, Hrida.ai exposes POST /oauth/backchannel-logout so your identity provider can trigger server-side logout without browser redirects.
• Usage: Set to true to enable the endpoint. Your identity provider should send a form-encoded logout_token that follows the OpenID Connect Back-Channel Logout 1.0 specification.

warning

Redis Requirement for JWT Revocation

Back-channel logout revokes existing Hrida.ai JWT sessions through Redis-based revocation keys. Without Redis, Hrida.ai can still remove stored OAuth sessions, but already-issued JWTs remain valid until they naturally expire.

For production SSO deployments, especially with multiple workers or replicas, configure REDIS_URL when enabling this feature.

info

Behavior Notes

• The endpoint returns 200 with an empty body for valid requests, including cases where no matching user is found.
• Invalid or malformed logout_token requests return 400 with invalid_request details.
• Back-channel logout revokes users by provider + sub claim matching. sid-only logout matching is not currently supported.

OAUTH_CLIENT_INFO_ENCRYPTION_KEY

• Type: str
• Default: Falls back to the value of HRIDAAI_SECRET_KEY.
• Description: Specifies the secret key used to encrypt and decrypt OAuth client tokens stored server-side in the database. This is a critical security component for OAuth client tokens. If not set, it defaults to using the main HRIDAAI_SECRET_KEY, but it is highly recommended to set it to a unique, securely generated value for production environments. OAUTH_CLIENT_INFO_ENCRYPTION_KEY is used in conjunction with OAuth 2.1 MCP server authentication.

OAUTH_SESSION_TOKEN_ENCRYPTION_KEY

• Type: str
• Default: Falls back to the value of HRIDAAI_SECRET_KEY.
• Description: Specifies the secret key used to encrypt and decrypt OAuth tokens stored server-side in the database. This is a critical security component for protecting user credentials at rest. If not set, it defaults to using the main HRIDAAI_SECRET_KEY, but it is highly recommended to set it to a unique, securely generated value for production environments.

warning

Required for Multi-Replica Deployments In any production environment running more than one instance of Hrida.ai (e.g., Docker Swarm, Kubernetes), this variable MUST be explicitly set to a persistent, shared secret. If left unset, each replica will generate or use a different key, causing session decryption to fail intermittently as user requests are load-balanced across instances.

OAUTH_MAX_SESSIONS_PER_USER

• Type: int
• Default: 10
• Description: Maximum number of concurrent OAuth sessions allowed per user per provider. When a user logs in and the number of existing sessions for that user/provider combination meets or exceeds this limit, the oldest sessions are pruned to make room for the new one. This prevents unbounded session growth while allowing multi-device usage (e.g., logging in from a desktop and a mobile device without invalidating either session).

OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE

• Type: bool
• Default: False
• Description: Ensures the full OAuth scope is included during refresh token requests instead of relying on provider defaults. When enabled, the configured scope (e.g. MICROSOFT_OAUTH_SCOPE) is passed to the identity provider during token refresh. This is required for providers like Microsoft where missing scopes can cause refresh failures, especially when using custom API scopes.

HRIDAAI_AUTH_TRUSTED_EMAIL_HEADER

• Type: str
• Description: Defines the trusted request header for authentication. See SSO docs.

HRIDAAI_AUTH_TRUSTED_NAME_HEADER

• Type: str
• Description: Defines the trusted request header for the username of anyone registering with the HRIDAAI_AUTH_TRUSTED_EMAIL_HEADER header. See SSO docs.

HRIDAAI_AUTH_TRUSTED_GROUPS_HEADER

• Type: str
• Description: Defines the trusted request header containing a comma-separated list of group memberships for the user when using trusted header authentication. See SSO docs.

HRIDAAI_AUTH_TRUSTED_ROLE_HEADER

• Type: str
• Description: Defines the trusted request header that determines the user's role (admin, user, or pending) when using trusted header authentication. When set, the user's role is updated to match the header value on every sign-in. Invalid values are ignored with a warning. See SSO docs.

Google

See https://support.google.com/cloud/answer/6158849?hl=en

info

You must also set OPENID_PROVIDER_URL or otherwise logout may not work.

GOOGLE_CLIENT_ID

• Type: str
• Description: Sets the client ID for Google OAuth.
• Persistence: This environment variable is a ConfigVar variable.

GOOGLE_CLIENT_SECRET

• Type: str
• Description: Sets the client secret for Google OAuth.
• Persistence: This environment variable is a ConfigVar variable.

GOOGLE_OAUTH_SCOPE

• Type: str
• Default: openid email profile
• Description: Sets the scope for Google OAuth authentication.
• Persistence: This environment variable is a ConfigVar variable.

GOOGLE_REDIRECT_URI

• Type: str
• Default: {'<backend>'}/oauth/google/callback
• Description: Sets the redirect URI for Google OAuth.
• Persistence: This environment variable is a ConfigVar variable.

GOOGLE_OAUTH_AUTHORIZE_PARAMS

• Type: str (JSON object)
• Default: {}
• Description: Adds Google-specific parameters to the OAuth /authorize request. Useful for Google flows that require extra parameters such as prompt, login_hint, or hd.

bash

# Example (.env)
GOOGLE_OAUTH_AUTHORIZE_PARAMS={"prompt":"consent","login_hint":"user@example.com","hd":"example.com"}

warning

GOOGLE_OAUTH_AUTHORIZE_PARAMS must be valid JSON and must be a JSON object. If parsing fails, Hrida.ai ignores it and logs a warning.

Microsoft

See https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app

info

You must also set OPENID_PROVIDER_URL or otherwise logout may not work.

MICROSOFT_CLIENT_ID

• Type: str
• Description: Sets the client ID for Microsoft OAuth.
• Persistence: This environment variable is a ConfigVar variable.

MICROSOFT_CLIENT_SECRET

• Type: str
• Description: Sets the client secret for Microsoft OAuth.
• Persistence: This environment variable is a ConfigVar variable.

MICROSOFT_CLIENT_TENANT_ID

• Type: str
• Description: Sets the tenant ID for Microsoft OAuth.
• Persistence: This environment variable is a ConfigVar variable.

MICROSOFT_OAUTH_SCOPE

• Type: str
• Default: openid email profile
• Description: Sets the scope for Microsoft OAuth authentication. This scope is also included in refresh token requests when OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE is enabled, which is required by Azure AD to avoid AADSTS90009 errors. If you use custom API scopes, include them here (e.g., openid email profile offline_access api://{'<Application ID URI>'}/{'<custom_scope>'}).
• Persistence: This environment variable is a ConfigVar variable.

MICROSOFT_REDIRECT_URI

• Type: str
• Default: {'<backend>'}/oauth/microsoft/callback
• Description: Sets the redirect URI for Microsoft OAuth.
• Persistence: This environment variable is a ConfigVar variable.

MICROSOFT_CLIENT_LOGIN_BASE_URL

• Type: str
• Default: https://login.microsoftonline.com
• Description: Sets the base login URL for Microsoft OAuth authentication. Allows configuration of alternative login endpoints for government clouds or custom deployments.
• Persistence: This environment variable is a ConfigVar variable.

MICROSOFT_CLIENT_PICTURE_URL

• Type: str
• Default: https://graph.microsoft.com/v1.0/me/photo/$value
• Description: Specifies the Microsoft Graph API endpoint for retrieving user profile pictures during OAuth authentication.
• Persistence: This environment variable is a ConfigVar variable.

GitHub

See

info

You must also set OPENID_PROVIDER_URL or otherwise logout may not work.

GITHUB_CLIENT_ID

• Type: str
• Persistence: This environment variable is a ConfigVar variable.

GITHUB_CLIENT_SECRET

• Type: str
• Persistence: This environment variable is a ConfigVar variable.

GITHUB_CLIENT_SCOPE

• Type: str
• Default: user:email
• Persistence: This environment variable is a ConfigVar variable.

GITHUB_CLIENT_REDIRECT_URI

• Type: str
• Persistence: This environment variable is a ConfigVar variable.

Feishu

See https://open.feishu.cn/document/sso/web-application-sso/login-overview

FEISHU_CLIENT_ID

• Type: str
• Description: Sets the client ID for Feishu OAuth.
• Persistence: This environment variable is a ConfigVar variable.

FEISHU_CLIENT_SECRET

• Type: str
• Description: Sets the client secret for Feishu OAuth.
• Persistence: This environment variable is a ConfigVar variable.

FEISHU_OAUTH_SCOPE

• Type: str
• Default: contact:user.base:readonly
• Description: Specifies the scope for Feishu OAuth authentication.
• Persistence: This environment variable is a ConfigVar variable.

FEISHU_REDIRECT_URI

• Type: str
• Description: Sets the redirect URI for Feishu OAuth.
• Persistence: This environment variable is a ConfigVar variable.

OpenID (OIDC)

OAUTH_CLIENT_ID

• Type: str
• Description: Sets the client ID for OIDC.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_CLIENT_SECRET

• Type: str
• Description: Sets the client secret for OIDC.
• Persistence: This environment variable is a ConfigVar variable.

OPENID_PROVIDER_URL

• Type: str
• Description: Path to the .well-known/openid-configuration endpoint
• Persistence: This environment variable is a ConfigVar variable.

danger

The environment variable OPENID_PROVIDER_URL MUST be configured, otherwise the logout functionality will not work for most providers. Even when using Microsoft, GitHub or other providers, you MUST set the OPENID_PROVIDER_URL environment variable.

Alternatively, if your provider does not support standard OIDC discovery (e.g., AWS Cognito), you can set OPENID_END_SESSION_ENDPOINT to a custom logout URL instead.

OPENID_END_SESSION_ENDPOINT

• Type: str
• Default: Empty string ("")
• Description: Sets a custom end-session (logout) endpoint URL. When configured, Hrida.ai will redirect to this URL on logout instead of attempting OIDC discovery via OPENID_PROVIDER_URL. This is useful for OAuth providers that do not support standard OIDC discovery for logout, such as AWS Cognito.
• Persistence: This environment variable is a ConfigVar variable.

OPENID_REDIRECT_URI

• Type: str
• Default: {'<backend>'}/oauth/oidc/callback
• Description: Sets the redirect URI for OIDC
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_SCOPES

• Type: str
• Default: openid email profile
• Description: Sets the scope for OIDC authentication. openid and email are required.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_CODE_CHALLENGE_METHOD

• Type: str
• Options:
  • S256 - Hash code_verifier with SHA-256.
• Default: Empty string (' '), since None is set as default.
• Description: Specifies the code challenge method for OAuth authentication. Set to S256 when PKCE is required by the provider.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_PROVIDER_NAME

• Type: str
• Default: SSO
• Description: Sets the name for the OIDC provider.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_USERNAME_CLAIM

• Type: str
• Default: name
• Description: Set username claim for OpenID.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_EMAIL_CLAIM

• Type: str
• Default: email
• Description: Set email claim for OpenID.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_PICTURE_CLAIM

• Type: str
• Default: picture
• Description: Set picture (avatar) claim for OpenID.
• Persistence: This environment variable is a ConfigVar variable.

info

If OAUTH_PICTURE_CLAIM is set to '' (empty string), then the OAuth picture claim is disabled and the user profile pictures will not be saved.

OAUTH_GROUP_CLAIM

• Type: str
• Default: groups
• Description: Specifies the group claim for OAuth authentication.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_OAUTH_ROLE_MANAGEMENT

• Type: bool
• Default: False
• Description: Enables role management for OAuth delegation.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_OAUTH_GROUP_MANAGEMENT

• Type: bool
• Default: False
• Description: Enables or disables OAuth group management.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_OAUTH_GROUP_CREATION

• Type: bool
• Default: False
• Description: When enabled, groups from OAuth claims that don't exist in Hrida.ai will be automatically created.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_GROUP_DEFAULT_SHARE

• Type: str
• Default: true
• Options:
  • true — Groups created via OAuth will have sharing enabled for anyone.
  • members — Groups created via OAuth will only allow sharing with group members.
  • false — Groups created via OAuth will have sharing disabled (no one can share).
• Description: Controls the default sharing permission for groups that are automatically created via OAuth group management. Only applies when ENABLE_OAUTH_GROUP_CREATION is enabled. Existing groups are not affected by this setting.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_BLOCKED_GROUPS

• Type: str
• Default: []
• Description: JSON array of group names that are blocked from accessing the application. Users belonging to these groups will be denied access even if they have valid OAuth credentials.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_ROLES_CLAIM

• Type: str
• Default: roles
• Description: Sets the roles claim to look for in the OIDC token.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_ALLOWED_ROLES

• Type: str
• Default: user,admin
• Description: Sets the roles that are allowed access to the platform. A value of * in the list acts as a wildcard that matches any role, so any user presenting a roles claim is allowed.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_ADMIN_ROLES

• Type: str
• Default: admin
• Description: Sets the roles that are considered administrators.
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_ROLES_SEPARATOR

• Type: str
• Default: ,
• Description: Allows custom role separators for for splitting the OAUTH_*_ROLES variables. Meant for OAuth roles that contain commas; useful for roles specified in LDAP syntax or other systems where commas are part of role names. If the claim is a string and contains the separator, it will be also split by that separator.

OAUTH_GROUPS_SEPARATOR

• Type: str
• Default: ;
• Description: Specifies the delimiter used to parse multiple group names from the OAuth group claim. This separator is used when the identity provider returns group memberships as a delimited string rather than an array. Useful when integrating with systems that use non-standard separators or when group names themselves contain commas.

OAUTH_ALLOWED_DOMAINS

• Type: str
• Default: *
• Description: Specifies the allowed domains for OAuth authentication. (e.g., "example1.com,example2.com").
• Persistence: This environment variable is a ConfigVar variable.

OAUTH_AUDIENCE

• Type: str
• Default: Empty string (' ')
• Description: Specifies an audience parameter passed to the OAuth provider's authorization endpoint during login. Some providers (such as Auth0 and Ory) use this value to determine the type of access token returned—without it, providers typically return an opaque token, while with it, they return a JWT that can be decoded and validated. This parameter is not part of the official OAuth/OIDC spec for authorization endpoints but is widely supported by some providers.

info

This is useful when you need a JWT access token for downstream validation or when your OAuth provider requires an audience hint for proper token generation. For Auth0, this is typically your API identifier (e.g., https://your-api.auth0.com/api/v2/). For Ory, specify the resource server you want to access.

OAUTH_AUTHORIZE_PARAMS

• Type: str (JSON object)
• Default: {}
• Description: Passes extra parameters directly to the OAuth provider's authorization endpoint during login. Use this when your provider requires custom authorize-time parameters that are not covered by dedicated variables.

Common examples include parameters like prompt, login_hint, domain_hint, resource, audience, or provider-specific flags.

bash

# Example (.env)
OAUTH_AUTHORIZE_PARAMS={"prompt":"consent","login_hint":"user@example.com"}

yaml

# Example (docker-compose)
environment:
  - OAUTH_AUTHORIZE_PARAMS={"prompt":"consent","login_hint":"user@example.com"}

warning

OAUTH_AUTHORIZE_PARAMS must be valid JSON and must be a JSON object (key/value map). If parsing fails, Hrida.ai ignores it and logs a warning.

info

If you set both OAUTH_AUDIENCE and OAUTH_AUTHORIZE_PARAMS containing an audience key, the value from OAUTH_AUTHORIZE_PARAMS takes precedence.

OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE

• Type: bool
• Default: False
• Description: When enabled, includes the configured OAuth scope in refresh token requests. Some OAuth providers, notably Microsoft Azure AD, require the scope to be explicitly provided when refreshing a token. Without it, Azure AD treats the request as the application requesting a token for itself, resulting in AADSTS90009 errors. Enable this if you encounter token refresh failures with your OAuth provider.
• Persistence: This environment variable is a ConfigVar variable.

info

This setting is compliant with RFC 6749 Section 6, where the scope parameter is optional during refresh token requests. Only enable this for providers that require it, such as certain Azure AD configurations.

LDAP

ENABLE_LDAP

• Type: bool
• Default: False
• Description: Enables or disables LDAP authentication.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_SERVER_LABEL

• Type: str
• Description: Sets the label of the LDAP server.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_SERVER_HOST

• Type: str
• Default: localhost
• Description: Sets the hostname of the LDAP server.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_SERVER_PORT

• Type: int
• Default: 389
• Description: Sets the port number of the LDAP server.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_ATTRIBUTE_FOR_MAIL

• Type: str
• Description: Sets the attribute to use as mail for LDAP authentication.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_ATTRIBUTE_FOR_USERNAME

• Type: str
• Description: Sets the attribute to use as a username for LDAP authentication.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_APP_DN

• Type: str
• Description: Sets the distinguished name for the LDAP application.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_APP_PASSWORD

• Type: str
• Description: Sets the password for the LDAP application.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_SEARCH_BASE

• Type: str
• Description: Sets the base to search for LDAP authentication.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_SEARCH_FILTER

• Type: str
• Default: None
• Description: Sets additional filter conditions for LDAP user search. This filter is appended to the automatically-generated username filter. Hrida.ai automatically constructs the username portion of the filter using LDAP_ATTRIBUTE_FOR_USERNAME, so you should not include user placeholders like %(user)s or %s — these are not supported. Use this for additional conditions such as group membership restrictions (e.g., (memberOf=cn=allowed-users,ou=groups,dc=example,dc=com)). Alternative to LDAP_SEARCH_FILTERS.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_SEARCH_FILTERS

• Type: str
• Description: Sets additional filter conditions for LDAP user search. This is an alias for LDAP_SEARCH_FILTER. The filter is appended to the automatically-generated username filter — do not include user placeholders like %(user)s or %s.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_USE_TLS

• Type: bool
• Default: True
• Description: Enables or disables TLS for LDAP connection.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_CA_CERT_FILE

• Type: str
• Description: Sets the path to the LDAP CA certificate file.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_VALIDATE_CERT

• Type: bool
• Description: Sets whether to validate the LDAP CA certificate.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_CIPHERS

• Type: str
• Default: ALL
• Description: Sets the ciphers to use for LDAP connection.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_LDAP_GROUP_MANAGEMENT

• Type: bool
• Default: False
• Description: Enables the group management feature.
• Persistence: This environment variable is a ConfigVar variable.

ENABLE_LDAP_GROUP_CREATION

• Type: bool
• Default: False
• Description: If a group from LDAP does not exist in Hrida.ai, it will be created automatically.
• Persistence: This environment variable is a ConfigVar variable.

LDAP_ATTRIBUTE_FOR_GROUPS

• Type: str
• Default: memberOf
• Description: Specifies the LDAP attribute that contains the user's group memberships. memberOf is a standard attribute for this purpose in Active Directory environments.
• Persistence: This environment variable is a ConfigVar variable.

SCIM

SCIM_ENABLED

• Type: bool
• Default: False
• Description: Enables or disables SCIM 2.0 (System for Cross-domain Identity Management) support for automated user and group provisioning from identity providers like Okta, Azure AD, and Google Workspace.
• Persistence: This environment variable is a ConfigVar variable.

SCIM_TOKEN

• Type: str
• Default: ""
• Description: Sets the bearer token for SCIM authentication. This token must be provided by identity providers when making SCIM API requests. Generate a secure random token (e.g., using openssl rand -base64 32) and configure it in both Hrida.ai and your identity provider.
• Persistence: This environment variable is a ConfigVar variable.

SCIM_AUTH_PROVIDER

• Type: str
• Default: ""
• Description: Specifies the OAuth provider name to associate with SCIM externalId values (e.g., microsoft, oidc). When set, SCIM operations store and look up externalId under this provider key in the user's scim JSON field, enabling account linking between SCIM-provisioned identities and OAuth logins. A warning is logged on startup if SCIM is enabled but this variable is not set.